Field notes.

Road to HTB CDEP

A selective roadmap for HTB’s Certified Detection Engineering Principal: all 13 path modules, focused preparation, and optional deeper study.

From DMG to Execution

Build a harmless macOS app and trace how its bundle and disk image lead to execution.

macOS Login Item Persistence

Test how a macOS Login Item is registered, resolved and launched after sign-in.

One Chokepoint, Three Loaders

Compare Windows, macOS and Linux library loading to find shared opportunities for detecting hijacking.

Where Does macOS EDR Telemetry Come From?

Explore where macOS security events originate and inspect them with Endpoint Security and Mac Monitor.

So You Want to Learn macOS Forensics?

A practitioner’s review of 13Cubed’s macOS investigations training and the artifacts it teaches.

Cracking a macOS Local Password Hash — A Hands-On Walkthrough

Follow a controlled test account’s password hash from its macOS record into a Hashcat exercise.

Thinking in Three Dimensions: How Security Analysts Can Balance Binary, Quantitative, and Qualitative Reasoning — A Think Piece

Use binary decisions, measurements and context together to reason about uncertain security alerts.

Scamware Analysis: FreeYoutubeDownloader.exe

Investigate a fake downloader’s packed payload and the tech-support scam it presents to victims.

Inside File Deletion: SSDs, SDelete, and Forensics

Examine how SSD behavior, TRIM and deletion tools affect recoverable files and surviving traces.

Verboten: Forensic CTF Walkthrough

Reconstruct a USB-triggered Windows compromise using registry artifacts and other forensic evidence.

Investigative Features in Microsoft Defender and Microsoft Sentinel for SOC Analysts

A working analyst’s guide to useful investigation features across Microsoft Defender and Sentinel.

Triage and Custom Detection Creation— Part 4

Trace a simulated phishing incident and build a Sigma rule for suspicious PowerShell download activity.

Configure Windows Audit Policy, Sysmon and Atomic Red Team — Part 3

Prepare Windows logging and use Sysmon with Atomic Red Team to exercise a detection lab.

Configuring Elasticsearch & Kibana — Part 1

Set up Elasticsearch and Kibana on Ubuntu as the foundation of a security monitoring lab.

Setting Up Winlogbeat & Filebeat for Log Collection — Part 2

Connect Windows event and file logs to an Elastic lab using Winlogbeat and Filebeat.

Snowflake log ingestion via Azure Functions

Connect Snowflake activity logs to Microsoft Sentinel using an Azure Functions-based data connector.

Phish or Swim: Part 2

Inspect a suspicious message, its headers and its attachment in a LetsDefend email-analysis exercise.

Phish or Swim: Part 1

Create a self-contained GoPhish practice campaign to develop email-analysis skills.

LetsDefend — Remote Working

Identify a suspicious spreadsheet and investigate its metadata with ExifTool, hex inspection and related tools.

LetsDefend — Memory Analysis

Use Volatility 3 to investigate a compromised Windows endpoint from its memory dump.

My PNPT Exam Experience

Enleak reflects on preparing for the PNPT, its practical format and lessons from the attempt.

My Security Blue Team Level One Exam Experience

A personal account of BTL1 preparation, hands-on blue-team training and the 2023 exam experience.

LetsDefend — WinRAR 0-Day (CVE-2023–38831)

Investigate suspicious WinRAR activity and related evidence in a LetsDefend memory-forensics challenge.

LetsDefend -PDF Analysis

Dissect a suspicious PDF’s embedded behavior with peepdf, CyberChef and supporting analysis tools.

MemLabs Lab 1: Beginner’s Luck

An archived introduction to investigating a Windows memory image with Volatility.

The original walkthrough is currently unavailable. This links to its archive note.

Thrunting with K80

A DE&TH conversation with K80 about threat hunting.

What We Learned About Threat Hunting This Week

DE&TH reflects on lessons from a week of threat hunting.

Threat Hunting Starts With Curiosity, Ft. Harshil

A conversation with Harshil on curiosity and threat hunting.